Riskcovery

CVE-2024-10306

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

State
Published
Severity
5.4 Medium
Published
Apr 23, 2025
Updated
Oct 21, 2026
Reserved
Oct 23, 2024

Read the record on cve.org

Description

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nredhat

Weaknesses

Affected Products

ProductVersions
mod_proxy_cluster
  • 1.3.17 to before 1.3.21.FinalAffected
Red Hat Enterprise Linux 10Red Hat
  • 0:1.3.21-1.el10 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
  • 0:1.3.22-1.el10_0.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.3.22-1.el9_5.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.3.22-1.el9_6.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:1.3.22-1.el9_4.1 and laterNot affected
Red Hat JBoss Core Services 2.4.62Red Hat
    Red Hat JBoss Core ServicesRed Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.